CVE-2022-28738

A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 60%
VendorProductVersion
ruby-langruby
3.0.0 ≤
𝑥
< 3.0.4
ruby-langruby
3.1.0 ≤
𝑥
< 3.1.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ruby2.7
bullseye
2.7.4-1+deb11u1
fixed
bullseye (security)
2.7.4-1+deb11u2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby2.3
xenial
not-affected
ruby2.5
bionic
not-affected
ruby2.7
jammy
dne
impish
not-affected
focal
not-affected
ruby3.0
kinetic
not-affected
jammy
Fixed 3.0.2-7ubuntu2.1
released
Common Weakness Enumeration
References
https://hackerone.com/reports/1220911
https://security-tracker.debian.org/tracker/CVE-2022-28738
https://security.gentoo.org/glsa/202401-27
https://security.netapp.com/advisory/ntap-20220624-0002/
https://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738/
https://hackerone.com/reports/1220911
https://security-tracker.debian.org/tracker/CVE-2022-28738
https://security.gentoo.org/glsa/202401-27
https://security.netapp.com/advisory/ntap-20220624-0002/
https://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738/